test(e2e): cover session policy settings

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

apps/sim/app/workspace/[workspaceId]/settings/[section]/page.tsx

@@ -63,6 +63,7 @@ const ORGANIZATION_SECTION_MAP: Partial<Record<SettingsSection, OrganizationSett
   'access-control': 'access-control',
   'audit-logs': 'audit-logs',
   sso: 'sso',
+  sessions: 'sessions',
   'data-retention': 'data-retention',
   'data-drains': 'data-drains',
   whitelabeling: 'whitelabeling',

apps/sim/e2e/README.md

@@ -408,9 +408,11 @@ contracts before the isolation project opens its two-worker pool.
 
 ## Stability gate and required CI
 
-The Step 7 source discovers 256 tests: 131 navigation/foundation, 84
-authorization, 13 credentials, 11 workflows, 15 persona contracts, and 2
-two-worker isolation tests.
+The current integrated source discovers 262 tests: 133 navigation/foundation,
+88 authorization, 13 credentials, 11 workflows, 15 persona contracts, and 2
+two-worker isolation tests. The six tests added after the frozen Step 7 gate
+cover the organization/workspace Session policies routes and their direct
+authorization/entitlement negatives.
 
 Retries remain fixed at zero while the suite is stabilized. The final gate is
 five Playwright executions per test against one healthy production stack, not

apps/sim/e2e/STABILIZATION.md

@@ -12,10 +12,11 @@ billing-enabled Chromium milestone. It complements the operational runbook in
   deletions. Generated Drizzle snapshots are classified as generated review
   material; migration SQL, schema declarations, and preflight code remain
   hand-reviewed.
-- Current Step 7 source discovers 256 tests: 131 navigation/foundation, 84
+- Current integrated source discovers 262 tests: 133 navigation/foundation, 88
   authorization, 13 credentials, 11 workflows, 15 persona contracts, and 2
-  isolation tests. The pre-Step-7 baseline was 254; Step 7 adds two foundation
-  safety policies for selective trace suppression and auth-screenshot clearing.
+  isolation tests. The pre-Step-7 baseline was 254; Step 7 added two foundation
+  safety policies, and the later session-policy setting added two canonical
+  navigation contracts plus four direct authorization/entitlement negatives.
 - Regenerate the exact inventory instead of copying a stale list:
 
   ```bash
@@ -53,7 +54,7 @@ are never committed.
 ## Navigation contract
 
 The explicit datasets in `e2e/settings/navigation/contracts.ts` are independent
-of `SETTINGS_SECTION_REGISTRY`: 37 canonical sections, 21 special route cases,
+of `SETTINGS_SECTION_REGISTRY`: 39 canonical sections, 21 special route cases,
 and 11 representative visibility cases.
 
 - `canonical-navigation.spec.ts` iterates every literal account, organization,
@@ -79,7 +80,7 @@ an explicit product decision and a paired update to the independent contract.
 ## Authorization and entitlement contract
 
 `e2e/settings/authorization/contracts.ts` owns literal access outcomes and
-semantic mutation probes: 47 direct access cases and 31 mutation-control cases.
+semantic mutation probes: 51 direct access cases and 31 mutation-control cases.
 Its integrity spec requires every declared gate axis.
 
 - Read, write, and admin workspace personas cover view/mutation boundaries for

apps/sim/e2e/settings/authorization/contract-integrity.spec.ts

@@ -109,14 +109,30 @@ test('Step 3 proof references resolve without rerunning their cases', () => {
 test('access contracts declare every required Step 4 gate axis', () => {
   expectSections(
     accessGateCases.filter(({ caseId }) => caseId.startsWith('organization-read-member-')),
-    ['access-control', 'audit-logs', 'sso', 'data-retention', 'data-drains', 'whitelabeling']
+    [
+      'access-control',
+      'audit-logs',
+      'sso',
+      'sessions',
+      'data-retention',
+      'data-drains',
+      'whitelabeling',
+    ]
   )
   expectSections(
     accessGateCases.filter(
       ({ caseId }) =>
         caseId.startsWith('organization-lapsed-admin-') && caseId.endsWith('-plan-denied')
     ),
-    ['access-control', 'audit-logs', 'sso', 'data-retention', 'data-drains', 'whitelabeling']
+    [
+      'access-control',
+      'audit-logs',
+      'sso',
+      'sessions',
+      'data-retention',
+      'data-drains',
+      'whitelabeling',
+    ]
   )
   expectSections(
     accessGateCases.filter(({ caseId }) => caseId.startsWith('workspace-member-')),
@@ -126,6 +142,7 @@ test('access contracts declare every required Step 4 gate axis', () => {
       'access-control',
       'audit-logs',
       'sso',
+      'sessions',
       'data-retention',
       'data-drains',
       'whitelabeling',
@@ -137,6 +154,7 @@ test('access contracts declare every required Step 4 gate axis', () => {
       'access-control',
       'audit-logs',
       'sso',
+      'sessions',
       'data-retention',
       'data-drains',
       'whitelabeling',

apps/sim/e2e/settings/authorization/contracts.ts

@@ -214,6 +214,21 @@ export const accessGateCases: readonly AccessGateCase[] = [
     sidebar: { state: 'hidden', label: 'Single sign-on' },
     outcome: { kind: 'organization-unavailable', title: 'Settings unavailable' },
   },
+  {
+    caseId: 'organization-read-member-sessions-denied',
+    plane: 'organization',
+    pathTemplate: '/organization/{organizationId}/settings/sessions',
+    driver: {
+      personaKey: 'workspaceReadMember',
+      binding: {
+        worldKey: 'settings-primary',
+        resourceKind: 'organization',
+        resourceKey: 'team-organization',
+      },
+    },
+    sidebar: { state: 'hidden', label: 'Session policies' },
+    outcome: { kind: 'organization-unavailable', title: 'Settings unavailable' },
+  },
   {
     caseId: 'organization-read-member-data-retention-denied',
     plane: 'organization',
@@ -324,6 +339,7 @@ export const accessGateCases: readonly AccessGateCase[] = [
     ['access-control', 'Access control'],
     ['audit-logs', 'Audit logs'],
     ['sso', 'Single sign-on'],
+    ['sessions', 'Session policies'],
     ['data-retention', 'Data retention'],
     ['data-drains', 'Data drains'],
     ['whitelabeling', 'Whitelabeling'],
@@ -366,6 +382,7 @@ export const accessGateCases: readonly AccessGateCase[] = [
     ['access-control', 'Access control'],
     ['audit-logs', 'Audit logs'],
     ['sso', 'Single sign-on'],
+    ['sessions', 'Session policies'],
     ['data-retention', 'Data retention'],
     ['data-drains', 'Data drains'],
     ['whitelabeling', 'Whitelabeling'],
@@ -442,6 +459,7 @@ export const accessGateCases: readonly AccessGateCase[] = [
     ['access-control', 'Access control'],
     ['audit-logs', 'Audit logs'],
     ['sso', 'Single sign-on'],
+    ['sessions', 'Session policies'],
     ['data-retention', 'Data retention'],
     ['data-drains', 'Data drains'],
     ['whitelabeling', 'Whitelabeling'],

apps/sim/e2e/settings/navigation/contracts.ts

@@ -268,6 +268,19 @@ export const sectionContracts = [
     driver: enterpriseOrganization,
     activeSidebarItem: true,
   },
+  {
+    contractId: 'organization-sessions',
+    plane: 'organization',
+    sectionId: 'sessions',
+    group: 'security',
+    label: 'Session policies',
+    pathTemplate: '/organization/{organizationId}/settings/sessions',
+    heading: 'Session policies',
+    description: 'Limit session lifetimes and sign out members org-wide.',
+    readiness: { kind: 'button', name: 'Sign out all members' },
+    driver: enterpriseOrganization,
+    activeSidebarItem: true,
+  },
   {
     contractId: 'organization-data-retention',
     plane: 'organization',
@@ -412,6 +425,15 @@ export const sectionContracts = [
       { kind: 'text', value: 'Provider Type' },
       enterpriseWorkspace,
     ],
+    [
+      'workspace-sessions',
+      'sessions',
+      'enterprise',
+      'Session policies',
+      'Limit session lifetimes and sign out members org-wide.',
+      { kind: 'button', name: 'Sign out all members' },
+      enterpriseWorkspace,
+    ],
     [
       'workspace-whitelabeling',
       'whitelabeling',
@@ -782,6 +804,7 @@ export const personaVisibilityCases = [
       'access-control',
       'audit-logs',
       'sso',
+      'sessions',
       'data-retention',
       'data-drains',
       'whitelabeling',
@@ -792,6 +815,7 @@ export const personaVisibilityCases = [
       'Access control',
       'Audit logs',
       'Single sign-on',
+      'Session policies',
       'Data retention',
       'Data drains',
       'Whitelabeling',
@@ -807,8 +831,20 @@ export const personaVisibilityCases = [
     driver: lapsedOrganization,
     expectedVisibleSectionIds: ['members', 'billing'],
     expectedVisibleLabels: ['Members', 'Billing'],
-    importantHiddenSectionIds: ['access-control', 'audit-logs', 'sso', 'data-retention'],
-    importantHiddenLabels: ['Access control', 'Audit logs', 'Single sign-on', 'Data retention'],
+    importantHiddenSectionIds: [
+      'access-control',
+      'audit-logs',
+      'sso',
+      'sessions',
+      'data-retention',
+    ],
+    importantHiddenLabels: [
+      'Access control',
+      'Audit logs',
+      'Single sign-on',
+      'Session policies',
+      'Data retention',
+    ],
     representativeSectionId: 'members',
     representativeLabel: 'Members',
   },
@@ -818,8 +854,8 @@ export const personaVisibilityCases = [
     driver: teamOrganizationMember,
     expectedVisibleSectionIds: ['members'],
     expectedVisibleLabels: ['Members'],
-    importantHiddenSectionIds: ['billing', 'access-control', 'audit-logs'],
-    importantHiddenLabels: ['Billing', 'Access control', 'Audit logs'],
+    importantHiddenSectionIds: ['billing', 'access-control', 'audit-logs', 'sessions'],
+    importantHiddenLabels: ['Billing', 'Access control', 'Audit logs', 'Session policies'],
     representativeSectionId: 'members',
     representativeLabel: 'Members',
   },
@@ -882,6 +918,7 @@ export const personaVisibilityCases = [
       'audit-logs',
       'forks',
       'sso',
+      'sessions',
       'data-retention',
       'data-drains',
       'whitelabeling',
@@ -905,6 +942,7 @@ export const personaVisibilityCases = [
       'Audit logs',
       'Workspace Forks',
       'Single sign-on',
+      'Session policies',
       'Data retention',
       'Data drains',
       'Whitelabeling',